An authorization object is what SAP use to assign and enables complez check to determine if the user is allowed to perform certain operations on the system.
An authorization object consists of authorization field and it can group up to 10 authorization fields which are checked with an AND relationship.
The authorization objects are considered as system elements to be protected and relate to data elements stered with the ABAP dictionary.
We can put a single value inside the field or a range of values.
The values are called authorizations and the system perform a check in OR relationship.
You can allow all values or an empty one as a permissible one.
The user needs all the right values to have the access to the determined system operation.
Usually when we talk about transactions assigned to a user we are talking about a check performed by the SAP system on all the authorization objects and authorization fields assigned to the user by roles.
When the user tries to start a transaction from teh menu or directly, the SAP system perform different cheks.
- the first chak is on the TSTC table to to see if the transaction is valid or doesn't exist.
- than the system checks teh authorization object S_TCODE which contains the authorization field TCD (Transaction code). The value inside should be the same as the name of the transaction.
After these cheks the user can access the transaction but in usually additional authorization object are needed to use the transaction.
Other authorization object can be added using the authorization object TSTA, wfich is stored in TSTCA table.
Alternativily could be added at program level the command AUTHORITY-CHECK.
You can use the transaction SU24 to look which authorization object are assigned to a determine transaction
An authorization object consists of authorization field and it can group up to 10 authorization fields which are checked with an AND relationship.
The authorization objects are considered as system elements to be protected and relate to data elements stered with the ABAP dictionary.
We can put a single value inside the field or a range of values.
The values are called authorizations and the system perform a check in OR relationship.
You can allow all values or an empty one as a permissible one.
The user needs all the right values to have the access to the determined system operation.
Usually when we talk about transactions assigned to a user we are talking about a check performed by the SAP system on all the authorization objects and authorization fields assigned to the user by roles.
When the user tries to start a transaction from teh menu or directly, the SAP system perform different cheks.
- the first chak is on the TSTC table to to see if the transaction is valid or doesn't exist.
- than the system checks teh authorization object S_TCODE which contains the authorization field TCD (Transaction code). The value inside should be the same as the name of the transaction.
After these cheks the user can access the transaction but in usually additional authorization object are needed to use the transaction.
Other authorization object can be added using the authorization object TSTA, wfich is stored in TSTCA table.
Alternativily could be added at program level the command AUTHORITY-CHECK.
You can use the transaction SU24 to look which authorization object are assigned to a determine transaction
